On Thursday afternoon, 12 November 2026, the working day stopped for millions of people at once. Email would not load. Calendars would not open. Meetings could not be scheduled, files could not be shared, and Microsoft’s Copilot assistant went quiet. The cause was a failure inside Microsoft 365 itself — the cloud service that now carries the daily work of businesses, schools, hospitals and governments in almost every country on earth.
By the time the worst of it passed, the outage had run for the best part of a day, drawn problem reports from 74 countries, and forced Microsoft into a public apology. The company says it has fixed the underlying problem. But as of Saturday morning, 14 November, the incident was still officially open, some customers were still seeing intermittent problems, and Microsoft had given no time for full recovery.
What happened: a timeline
The failure began with email. At 16:17 UTC on Thursday 12 November — 11:17 in the morning on the east coast of the United States, and 9:17 in the evening in Pakistan — Microsoft’s Exchange Online service, the system behind Outlook for work and school accounts, began failing. Users could not reach their mailboxes through Outlook on the web, the desktop app, or mail apps on their phones. Microsoft opened an incident record for it, EX1550543.
Within about two hours the problem had spread far beyond email. At around 18:26 UTC Microsoft opened a second, wider incident, MO1550821, covering the rest of Microsoft 365, and warned that users in any region could be affected. By then Downdetector was recording a flood of complaints: Outlook problem reports peaked at 138,058 at around 1:00 pm Eastern time on Thursday, according to Reuters, while the BBC put the global peak at nearly 140,000 reports at around 18:00 GMT — roughly 2,000 times the normal level — with reports coming in from 74 countries within about an hour.
Through Thursday night and into Friday, Microsoft’s updates told a frustrating story. The company said a large number of its servers had become unexpectedly unavailable, putting extra load on the machines still running. It tried restarting servers and redirecting traffic. Some servers came back, then failed again once traffic returned. At one point Microsoft admitted its fixes were “not taking as expected”.
The first real turn came on Friday morning, when Microsoft said a patch to an upstream authentication and routing component was helping. By Friday afternoon, US time, the company apologised and reported “broad recovery and stability across our services”, with parts of Asia Pacific among the first regions to recover fully. Even so, late on Friday Microsoft was still telling customers it had no estimated time for full recovery, and its incident records still showed “service degradation” on Saturday morning. Microsoft had also extended delayed-mail delivery from 24 to 48 hours so messages would keep retrying instead of bouncing.
Which services were hit — and which kept working
Outlook and Exchange Online were hit hardest, but the damage spread through the whole Microsoft 365 family because so many of its tools depend on the same email and identity systems. Microsoft’s wider incident notice listed Exchange Online, Microsoft Teams, SharePoint Online, Microsoft 365 Copilot and Microsoft Defender XDR as potentially affected, and the list grew during the day to include Planner, To Do, Intune, Purview, Power BI, Power Apps, Microsoft Graph, Universal Print and Windows 365 Cloud PCs.
The effects were uneven, which made the outage harder to deal with than a clean blackout. In Teams, calls, meetings and chats largely kept working if a meeting link already existed, but calendars, scheduling and meeting invitations failed. In SharePoint and OneDrive, some features that rely on Exchange stopped working while plain file access often carried on. Copilot was disrupted wherever it depends on mailbox and calendar data. Notably, consumer Outlook.com stayed operational — the failure centred on work and school accounts — and Azure, its separate cloud hosting business, was not listed in the incident. The failure was inside Microsoft 365’s own infrastructure, not a collapse of the whole Microsoft cloud.
What Microsoft says caused it
For most of Thursday and Friday, Microsoft’s explanation was vague: servers were failing health checks, and a process that sets up secure connections was overwhelmed. Then, in its Friday afternoon update, the company gave its first plain account. In Microsoft’s own words, the incident “was introduced by an issue during an earlier network capacity upgrade that surfaced following a recent network change.” In a statement shared with Sky News, Microsoft put it more directly: several months ago it upgraded its network gateways to add capacity, and that upgrade introduced a bug.
Pieced together from Microsoft’s updates, the chain of events looks like this. A recent network change exposed a defect left behind by the earlier gateway capacity upgrade. Affected servers began failing their automated health checks and were pulled out of service. With fewer servers available, the rest took on more traffic than they could handle, and a process on those servers responsible for establishing secure connections became overwhelmed.
Microsoft has been equally clear about what did not cause the outage. The company says it is “not aware of any malicious activity”, and its executive vice president Charles Lamanna confirmed there was no indication of a cyberattack. Microsoft described the event as “a technical issue not related to cyber or AI / agents”. There is no evidence of hacking here. The failure was, by Microsoft’s own account, self-inflicted: a bug in its own network upgrade, woken up by its own later change.
What Microsoft has not explained yet
The account above is Microsoft’s interim explanation, not a finished verdict. The company has promised a full post-incident report “once our review is complete”, and that report has not been published. Until it appears, several important questions have no answer. Microsoft has not said what exactly went wrong inside the gateway capacity upgrade, or which recent network change exposed the defect. It has not explained why its safeguards failed to contain the problem, or why recovery took the best part of a day. It has not said how many customers were affected: Downdetector’s figures count user reports, not affected accounts, and Microsoft has not published its own number. And it has not said what it will change to stop the same thing happening again. Those answers are the real test of this incident: an apology and a recovery are welcome, but a credible plan to prevent a repeat is what customers, and regulators, will be looking for.
Why it matters: one provider, everyone’s working day
The outage is a reminder of how much of the world’s work now runs through a single company’s servers. Microsoft 365 is not just an email product. For most organisations it is email, calendars, meetings, documents, file storage, device management and security monitoring, and increasingly the AI assistant that drafts and summarises their work. When it fails, there is no separate system to fall back on, because the same system is the fallback.
The real-world damage went well beyond annoyed office workers. NHS surgeries and pharmacies, schools, police forces and Parliament in Britain were among those affected, according to BBC reporting, and the BBC’s own corporate email was down. Hospitals, courts, government departments and airlines were disrupted in several countries, and in India major airlines issued passenger advisories. The outage even reached beyond Microsoft’s own products: connectors used by the AI services OpenAI and Anthropic were also affected, according to Reuters.
That reach is the deeper story: the modern workplace has quietly consolidated around a handful of cloud providers, and the tools meant to make work more resilient have become a single point of failure. This is the same pattern the world saw in the CrowdStrike outage of 2024, when a faulty software update took down more than 8.5 million Windows machines, and again in the Amazon Web Services failure only weeks ago. Each time, the lesson is the same: the cloud is not a place where things cannot break. It is a place where, when things break, they break for everyone at once. The outage also lands at a moment when investors are already asking hard questions about the AI boom — the same week saw AI stocks lose $3 trillion in a single day — and AI assistants like Copilot are only as reliable as the cloud services underneath them, as our explainer on Tencent’s HY4 vision-language AI shows.
What users and admins could do
For most people caught in the outage, there was little to fix on their own side. The problem was on Microsoft’s servers, not on any laptop, phone or office network, so reinstalling Outlook or changing a password would not have helped. The sensible steps were simple ones. First, check the official status: Microsoft’s public status page, or the Service health section of the Microsoft 365 admin centre, using the incident numbers EX1550543 and MO1550821. Second, do not resend delayed mail: with the delivery timeout extended to 48 hours, messages stuck in queues should still arrive, and resending only adds to the backlog. Third, use channels that were still working — phone calls, text messages, and Teams meetings joined through existing links.
For administrators, the outage is a prompt to check the basics: that someone can reach the status page without going through the broken service, that there is an out-of-band way to tell staff what is happening, and that critical messages have a second route. One warning from security researchers is worth passing on: outage-themed password-reset lures appeared within hours of the failure, so an unexpected “reset your Outlook password” message should be treated with suspicion — go to Microsoft’s official pages directly rather than clicking a link in an email.
What to watch next
Three things will decide how this story ends. The first is the post-incident report. Microsoft has promised a full account of what went wrong and what it will change, and that document — not the apology — is the real deliverable. Watch for whether it names the faulty change, explains why the defect escaped testing, and commits to specific fixes. The second is the recovery itself. As of Saturday morning the incidents were still open, with no time given for full recovery and delayed mail still draining. The third is the commercial fallout: whether large customers demand service credits, and whether organisations start building real backup plans — a second email route, offline copies of critical documents, a tested way to keep working when the cloud goes dark.
None of that will bring back the lost working day. Microsoft’s systems failed because of a bug in its own upgrade, and the company has said so. The question now is whether the fix is as thorough as the apology was prompt.
Sources
- Microsoft 365 Service Health status page (Microsoft) — live status for incidents EX1550543 and MO1550821
- Digital Trends — “Outlook is out, but it’s finally restoring slowly”
- The Hindu BusinessLine (ANI) — “Microsoft apologises after global outage disrupts Outlook, Teams and Copilot for nearly 18 hours”